The Impact of Electronically Stored Information on Corporate Legaland Compliance Management
White paper

The impact of electronically stored
information on corporate legal andcompliance management:
An IBM point of view

By Barbara Churchill, Linda Clark, Jonathan Rosenoer
and Fritz von Bulow, IBM Corporation

October 2006

The impact of electronically stored information on corporate legal and compliance management: An IBM point of view
Page 

Introduction
Contents
2
2

Introduction
E-mail as a source of discoverable
documents

4

Be prepared for electronic discovery

7

Root causes of common electronic
discovery issues

18 E-mail management
19 Is records management practicalfor ESI?
19 Audit considerations
20 Summary of best practices forelectronic records management
25 Conclusion
25 For more information
26 Appendix
28 Table: Summary of rule changes
31 End notes

This paper presents an IBM point of view on the impact of electronically stored
information (ESI)1 on regulatory compliance and the process involved in legal“discovery,” and the importance of managing ESI within the context of acorporate records management program. The magnitude and range ofcompliance risks associated with the management of ESI is driving IBM’s
investment in the development of more effective approaches and products
designed to provide an integrated and leverageable platform to support
regulatory compliance, legal discovery and life-cycle records management
needs, as well as to provide cost savings and value creation. As regulators andcourts increasingly recognize the enhanced and richer information value ofelectronic data compared with physical documents, companies should
strengthen their ability to safeguard their rights and respond appropriately.
Companies also need to recognize and avoid the implications posed byredundant and often duplicative siloed systems designed to address particularrequirements (for example, Sarbanes-Oxly [SOX] Act compliance, electronic
discovery, document retention management and so forth).2
This paper highlights some factors that can influence a company’s ability tomaintain and manage ESI in a manner that effectively supports corporate
compliance and records management objectives as well as the electronic
discovery process. It also describes key system and process attributes that are
helpful to support these efforts. Topics that are of particular interest forelectronic discovery and records management, such as treatment of e-mailand metadata, are explored to aid strategic and tactical planning activities forresponsible executives.
E-mail as a source of discoverable documents: the need for an electronic discovery
process and records management enabled by technology

Managing the discovery and production of ESI can best be approached as anintegrated end-to-end process. Although e-mail is one of the top requests inregulatory investigation and civil discovery, the IBM team believes that asignificant number of companies have yet to manage their e-mail systems asa key source of discoverable information and establish a searchable e-mailarchive.3 The IBM team thinks it likely that even fewer companies recognizethat all ESI is potentially subject to the same scrutiny and investigation as
e-mail and have taken steps to implement systems, policies, and protocols tomanage retention of ESI across the enterprise.

The impact of electronically stored information on corporate legal and compliance management: An IBM point of view
Page 

Highlights

The tremendous volume of ESI, e-mailbeing a primary example, creates
challenges for legal discovery.

A major challenge in the discovery process is the tremendous volume of ESI,
even if the discovery request is limited to e-mail. This is because of increasing
corporate reliance on electronic communications and the ease of exchanging
information electronically. At the same time, we believe many companies havenot implemented e-mail management policies which would enable them tosafely reduce their storage of older documents.

Managing and controlling the growthof ESI through retention policies andenabling technology can help toaddress this challenge.

Compliance rules are varied and event driven, requiring mechanisms
to apply rules consistently based on event triggers
Government - OSHA

Toxic exposure - 30 years
Records for food (manufacturing, processing, packing) - 2 years after release

Life Sciences/
Pharmaceutical(21 CFR Part 11)

Records for drugs (manufacturing, processing, packing) - 3 years after distribution
Records for bio products (manufacturing, processing, packing) 5 years after end of manufacture
Medical records - hospital (either original or legally reproduced form)

Healthcare
HIPAA

Medical records for minors from birth to 21 -> possibly life
Medical records - 2 years after patient death
Financial statements
Member registration for broker/dealers - end-of-life enterprise

Financial Services(SEC 17a4)

Trading accounts records - end of account plus 6 years

Sarbanes-Oxley

Financial and correspondence data - 4 years after audit
Years
1

2 3

4

5

10

15

20

25+

Source: Enterprise Storage Group,
Compliance study,
May 2003

Figure 1. ESI retention requirements, in some cases, do not begin until a particular event has occurred.

Also contributing to the growing volumes of e-mail and other forms of ESI is
the potential difficulty of implementing consistent destruction policies.
Retention requirements are often event driven, based on the occurrence of afuture payoff event (such as settlement of a claim or payoff of a mortgage).
This has posed a significant challenge for records and content management
technologies that can handle only simple retention rules (for example, destroy
five years from the creation date). It is our experience that a great manyretention requirements in formal records management programs are event
dependent, as illustrated by a study conducted by IBM in May 2003 (see Figure 1).
Newer technologies (such as Integrated Content Management) have thecapabilities to address these issues to help companies manage the lifecycle of
ESI and implement complex retention rules. Improved capabilities to facilitate
the compliant destruction of ESI may significantly reduce the amount of ESI
being maintained across an enterprise.

The impact of electronically stored information on corporate legal and compliance management: An IBM point of view
Page 

Highlights

Reducing the volume of ESI requires records management and retention
policies supported by a technology solution that is flexible, scalable andcapable of consistent operation in the normal course of business. E-mail is agood example of why organizations should revisit their records management
and retention policies and consider the risks and other issues posed by ESI. Of
particular concern should be how new technologies impact these policies.
Organizations that fail to understand and consider new tools and methodologies
may not only increase risk, but also miss a substantial opportunity toremove cost.
Be prepared for electronic discovery

To be prepared for electronic
discovery, have a plan and a process

How can one prepare for a future electronic discovery? Experience shows that
there is no silver bullet, but potential solutions are beginning to emerge.
Examining your practices and capabilities in light of the following approaches
can be helpful:that you can improve upon over time.

• Have a plan and a process for discovery of ESI that you can improve overtime. Understand your end-to-end process from discovery to production andthe implementation of “holds.” This encompasses methods and practices thatmake sense for your organization, understanding where technology is needed
to facilitate or improve process efficiencies or quality of results, and identifying
which specific technology capabilities are required to make your end-to-end
process effective. It is best accomplished through a cooperative effort amonglegal, IT, and the line of business (LOB) organizations (see Figure 2).

Multiple stakeholders collaborate to plan and develop e-discovery
and compliance processes
Business

Legal
Evaluate regulatory
requirements and address
challenges on compliance
Respond to legal events

Set and manage thebusiness priorities
Respond to Establish
outside forces policy

Represent the corporation
Deliver service

Establish the polices andbest practices
Enforce the organizational
compliance

IT & operations
Deliver cost-effective, open, flexible and automated IT systems
and processes accross all information assets and in support of all
stakeholders

Figure 2. Electronic discovery and compliance processes stakeholders

The impact of electronically stored information on corporate legal and compliance management: An IBM point of view
Page 

Highlights• Consider technology capabilities such as dedicated computer storage andprocessing resources with robust security, inventory, and identification ofsources of ESI potentially relevant to the request. Also look at search andOther activities to prepare for

retrieval tools that can be responsive to the request and are robust enough toelectronic discovery:

deliver results in tight time frames and with the appropriate degree of precision,
among others. You should also consider integrated content management, which• Consider technology capabilities

provides “middleware” to link multiple sources of ESI for search, retrieval andpossible collection, if there are multiple content sources.4• Conduct benchmarks• Conduct benchmarks to test and establish estimating parameters for various
electronic discovery scenarios. Repeatable processes that have been tested• Develop processes

to provide evidence of results sought after records production for a given setof metrics can be a significant key to negotiating e-discovery requests, to• Implement records management

effectively planning the response activities and timeframe, and to prudently
applying resources and budget.

• Develop repeatable processes that have the flexibility to accommodate avariety of discovery and regulatory requests. Electronic discovery is not a onetime occurrence for many organizations. Requests for information continue
to increase whether from regulators, courts, government, or public interest
groups. Traditionally, each “case” might have been managed by a different
functional unit, attorney or firm dictating different approaches, practices andtechnical framework. Many now realize that the basic process and technology
used to conduct electronic discovery can be separated from the legal or businessstrategy and these need not be “unique” solutions. Whether discovery results
should be siloed or not is a question to be determined in consultation withprofessionals (legal counsel, accounting professionals, or others) and basedon particular circumstances. However, the technology methods and solutions
can be developed with the flexibility to accommodate a variety of capabilities,
scenarios and needs, while being based on a common architectural platform
and a common set of products. 5

The impact of electronically stored information on corporate legal and compliance management: An IBM point of view
Page 

Highlights• Develop and implement records management and retention policies that caneffectively preclude retaining nonmaterial information. Formal guidance topromote the appropriate and prompt disposal of unneeded ESI is an important

Maintaining an inventory of ESI
sources, implementing an ESI records
management program, and keeping

component of records management.

• Maintain an inventory of ESI sources that documents system descriptions andcharacterizations such as computing system and location, software product andthe program updated with changing

version, business purpose and scope, data storage (active drives or archives),

regulatory and enforcement

retention location and periods for backup data, estimated volume of data being

requirements will help you prepare forretained, native capabilities for search and data formats, and so forth. This

electronic discovey negotiations.

inventory provides auditors and legal counsel with data needed to estimate
electronic discovery time and costs and to determine an efficient and reasonableapproach to develop the body of material for legal review. If this type of
inventory does not presently exist, a potentially reasonable approach is to createit through a project led by the technologies team, with the active participation of
those needed to help gather and evaluate such data, such as legal counsel andauditors. They should provide guidance as to their requirements and needs, andas beneficiaries of the inventory project, might also provide budgetary support.
Even electronic discovery requests for e-mail can result in subsequent requests
for data from other systems to which messages can be linked or referenced, andthis separate inventory can provide considerable value.

• Implement an ESI records management program that controls the volume of
information through appropriate and regular destruction of ESI in the normal
course of business. In addition to establishing and implementing destruction
policies, the records management program also should provide the mechanisms
and protocols to suspend destruction for specific ESI required to comply withdiscovery and preservation orders. A major cause of the explosion in ESI
volumes is the practice of keeping “everything” because of hold orders, rather
than limiting holds to only the information required. Hold orders ideally should
not cause major disruptions in document- or ESI-management processes. The
protocols for implementing and ultimately releasing holds should be built on
and leverage the records management system used in the normal courseof business.

The impact of electronically stored information on corporate legal and compliance management: An IBM point of view
Page 

Highlights• Keep pace with changing regulations, new requirements and trends inenforcement. Have a process whereby compliance or regulatory affairs, orwhatever organization has the responsibility to monitor regulatory initiatives

Legacy data can be a major concern.

and implement compliance measures for new regulations, communicates therequirements across the enterprise. These communications would include, for

Addressing legacy data requires anexample, legal, technologies, risk management, records management, audit andunderstanding of the record retention

relevant LOB management. Potential impact of legislation such as SOX andand accessability requirements,

Basel II (financial services) on requirements for controls and audit trails acrossdetermining which data needs to be

intra-organizational boundaries should be understood. Records management

retained, and determining the best

mechanisms, technologies, and protocols for retention and destruction should beapproach for storage.

reviewed and appropriately updated in a timely manner.

For further information and considerations about preparing for the new Rulesof Civil Procedures for electronic discovery, see the appendix of this paper.
Root causes of common electronic discovery issues

Corporate legal counsel can more effectively approach electronic discovery
when armed with specific knowledge of what information is being maintained,
how it relates to business activities, and how it can be accessed and produced in
the event of a discovery order. It is a challenge for any company to predict
electronic discovery costs and issues, but there appear to be some common
factors that may make electronic discovery difficult and costly across a varietyof enterprises.
Issue 1: Legacy data and ESI• Legacy data can be a major concern. This data might have been inherited from anacquired company or be data that was not migrated after a technology upgrade.

These systems, which in many cases can be made accessible only by maintaining
older or obsolete software and hardware, can contain accounting, finance,
customer data or other LOB information. In addition to the administrative costsof maintaining this data on the network, people with the skills to understand thecontext of the data and the available access protocols must be kept on staff. Thesesystems can be especially troublesome to search, and it can be difficult to collect, culland produce required ESI because of their obsolete or historical design or lack ofsupport for these functions.

The impact of electronically stored information on corporate legal and compliance management: An IBM point of view
Page 

Highlights• The first step to address legacy data issues is to inventory the information andidentify what records retention requirements apply. It might be preferable todocument the inventory and analysis, and establish appropriate retention policies
in advance of the need to produce ESI because of legal or regulatory actions or forother purposes. This important first step can lead to decisions to eliminate some ofthe systems, and can decrease the volume of data for others where there is still aretention requirement. You might want, in consultation with your business experts
and counsel, to document the process of decommissioning systems and the method of
ESI destruction.

• The second step is to weigh the costs of retaining the data using another approach,compared to current costs and the difficulties of producing the data when required.
Some options are:- Converting the data or migrating it to the current technology platform in a 		manner that will not jeopardize its integrity.6- Migrating the data to an archiving platform where it can be maintained

		 on lower-cost storage and would no longer be an administrative cost		 or performance burden on the network, but where data can be accessed, 			
searched, and retrieved in a useable form if needed.

Assess your legacy data.

• Determine how significant the legacy data issue is:- One company that the IBM team knows of accumulated more than 30 000
databases from its collaboration system over a period of ten years. With no 		records management and retention policies in place for ESI, many of these
databases had become “orphans” with no current owner identifiable who 		
could aid in establishing possible business value of the databases.

- Another company the IBM team knows of had more than 25 existing systems(mainly because of acquisitions) that were burdening its network, and 		
required additional staff with the special skill sets needed to maintain these 		applications because the business value and retention requirements for this 		ESI had not been established.

The impact of electronically stored information on corporate legal and compliance management: An IBM point of view
Page 

Highlights• To help prevent the legacy data issue from reappearing in the future, update
IT governance processes to include identifying record retention requirements
as part of the systems implementation methodology (including absorbing datafrom corporate acquisitions or mergers). The costs and methods for dealing withlegacy data in accordance with appropriate compliance practices should bepart of the overall system implementation and maintenance budget. You should
not leave data-migration and conversion requirements to the end of the project,

Electronically stored documents haveand you should evaluate and disposition legacy data as part of the records

a distinct lifecycle and somemanagement program implementation.

organizations may benefit frominstituting controls appropriate to eachIssue 2: Lack of life-cycle management and controls for ESI

life-cycle stage in accordance with

Both poor retention practices and issues such as orphan records (thosehaving no identifiable owner) can be mitigated by recognizing thatelectronically stored documents have a distinct lifecycle and that controls
can be imposed appropriate to each life-cycle stage after management
policies are established. Each type of ESI may have unique life-cycle stages
with differentiated controls and policies. Archiving and migration policies
for messaging-type ESI provide one example of how life-cycle management
is being applied. (See Figure 3.)

their management policies.

Retain electronic messages in a secure, scalable, flexible
archive repository
Utilize a tiered storage environment andstorage compression technology to
reduce retention costs- Implement tiered storage environment- Utilize flexible archiving options- Leverage single-instance store andcompression technology
Protect Information- Utilize capture and classify methods to ensure
e-mail authenticity and protection from edit
or deletion- Ensure information integrity- Use non-repudiable audit trails for compliance- Use security and encryption to prevent
unauthorized users from acessing critical data

Offload e-mails to archive

E-mail system
High-performance
disk
Tier 2 - DR550
DeleteTier 3
WORM tape

Delete, based on retention rule
Archiving example

Ensure information is available on demandthroughout its life cycle- Availability, continuity, recoverability, replication

Tier 1 - High-performance disk
(Sub-second response)

Move to secondary
storage after
xx daysTier 2
WORM tape or opticalFigure 3. Archiving and life cycle management example for electronic message systems

The impact of electronically stored information on corporate legal and compliance management: An IBM point of view
Page 10Highlights• Document management systems are gradually replacing the use of shared
drives for storage and access to electronic documents. Document management
technology also provides abilities to purge, disposition and search for electronic

Document management technology

documents in ways for which there is no physical paradigm. For example,

facilitates application of lifecycle

compound, complex documents consisting of embedded files (a spreadsheet

controls and can provide a chain ofwithin a text document, for example) or hyperlinks require new types of methods

custody, mitigating the occurrence ofand tools for effectively responding to discovery and document production

orphan records.

requests. In addition, the metadata (much of which cannot be directly accessedor printed) can provide helpful ways to manipulate, search and contextualize
the data.

• Orphan records — which can be database backups, files on shared drives orother electronic information with no apparent or designated owner — represent
costs and risks that could be potentially mitigated with more effective document
management practices. It might be difficult to ascertain whether these are
duplicates of other record holdings, drafts or otherwise out-of-date informationthat should not be retained. Orphan records create a burden for discovery
efforts, and can be more easily overlooked when searching for materials,
because there is no current business owner with responsibility for dispositioning
these records or even cognizant of their location and content. Orphan records
Other considerations for ESI lifecycle

can be a significant portion of files on shared network servers as well, increasing

controls are:network maintenance and backup costs as well as the number of servers to be
procured and maintained.

• Proper use of CD’s

• Use of CDs to store copies of information can result in loss of control of ESI. CDs
can be easily transported and are outside any technical system of accountability• Security and disposition of laptop
dataand could easily be misplaced or misused.

• Information stored on laptops is a growing threat to the security andconfidentiality of ESI and this kind of information is discoverable. Laptops• Automating the application ofstandards

have been subpoenaed in court actions and they also can pose risk of data
privacy breaches. Incidents with laptops, as well as magnetic tapes, have beenreported on a regular basis in the United States.

The impact of electronically stored information on corporate legal and compliance management: An IBM point of view
Page 11• Awareness of relevant life-cycle stages and instituting associated controls is a
key means of automating standard practices such as:- Deleting drafts after the document has progressed to the “record” or 			“published” state where appropriate to comply with corporate policy- Promoting the use of metadata standards for identification, classification, 		
ownership and other useful denominators- Promoting security and change privileges for documents that are 			differentiated based on their life-cycle stage- Providing for the disposition of documents based on life-cycle stage and 		
retention policy (for example, archive when superseded)- Providing capabilities to trigger archiving or transfer to lower-cost storage
based on aging combined with attaining a life-cycle stage (for example, 		archive two years after attaining record status)- Automating the migration of e-mail and messaging content as well as
application data (for example, enterprise resource planning [ERP] systems)
to online archives where ESI can be easily accessible while improving the 		
efficiency of the source applications•

Steps some companies are taking to improve life-cycle control of ESI:

- Inventory ESI on shared drives and obtain assessment of business use and 		value from owners- Develop retention categories and policies that are practical for both auto-		
assisted and manual classification of ESI- Migrate documents required for compliance with retention policies to a
document management platform with life-cycle capabilities to control
storage, access, and dispositioning with automated or semi-automated rules; 		
eliminate “shared drives” from the network- Enforce storage and retrieval of “controlled” files using only the document
management system by eliminating “desktop” document files and folders as 		well as shared drives

The impact of electronically stored information on corporate legal and compliance management: An IBM point of view
Page 12Highlights- Control what information is retained on employee computers using records
management software that automatically attaches and enforces
disposition rules- Promote other policies and practices that will bring “order from chaos” in 		
regards to document retention.

- Establish protocols for electronic discovery leveraging the standards andcapabilities of document management, archiving, and federated records
management and search platforms. E-mail archiving and complex query 		
technologies are high priority.
Corporate record retention programs

Issue 3: Outdated corporate retention policies and implementation methods that are

and policies — especially classification

ineffective for ESI

schemes — may need to be realigned to• Our recent experience discussing records management for ESI with a variety ofeffectively support both records

companies shows that many have not yet taken significant steps to realign their

management and legal discovery

corporate record retention policies and methods to effectively address ESI andfor ESI.

support electronic discovery. Some examples:- Retention schedules are based on organizations, departments or business
units rather than business functions, processes and systems. Modern businesssystems are used by multiple departments and data ownership might be 		dispersed as well, requiring updated classification models.

- Nomenclature on corporate records retention schedules can be based on
titles of physical reports or documents that can have multiple files, file types 		or system components in today’s ESI technical environment. Some examples
are embedded files (spreadsheet within a text document) and dynamic 		
Web content. Understanding how the ESI is structured and which ESI is the 		equivalent of scheduled physical records can be a significant project.

- If corporate records management policies do not address ESI, electronic
documents and data stores may have no formally designated retention.
Retention practices and policies might be formulated and implemented by
IT without due consideration of compliance needs or consultation with 		appropriate professionals, such as auditors or legal counsel.

The impact of electronically stored information on corporate legal and compliance management: An IBM point of view
Page 13Highlights- Nomenclature and classifications are not structured in a manner that
it is feasible to create automated or semi-automated rules for an ESI
implementation. Simplifying and rethinking the approach and design ofretention and disposition “rules” might be needed to effectively match ESI
with applicable compliance requirements and to best conform them to beadequately responsive to electronic discovery and document
preservation orders.

- Data recovery files become the means of fulfilling retention requirements.
Retention periods for these files can be established by IT with no consultationor formal approval of appropriate corporate personnel, such as auditors
legal counsel or compliance experts. Files created with data-recovery
software are designed to be used with “restore” programs should that needarise. They typically are not designed for any other purpose (for example,
searching or viewing of data), and if the backup files do not match the current
technical configuration (not created with the current version of the system or 		
application, for example) they will be the most costly and difficult to “restore” 		to an accessible format.

- Protocols and mechanisms for expunging or certifying destruction of records,
which have been an important element of physical records management		 programs, might be nonexistent, informal or not adequately documented toevidence that disposal of ESI was done in accordance with the company’s
Doing an overhaul of the records
management program toaccommodate ESI and dealing withthe growing volumes of ESI may
require new skills, protocols,
and technologies.

		 records management and retention policy and in compliance with		 requirements for audit trails.7 Use of Write Once Read Many (WORM) media,
		 implemented without consideration of requirements for expungement of ESI
		 having diverse retention periods, can result in companies violating their own 		
retention policies.

• To avoid increasing risk and costs of noncompliance, it is probably advisable notto just update the records retention and management program, but to completely
overhaul it. This requires knowledge of electronic records, records management,
and ESI technology issues and characteristics, as well as an understanding of
the total information fabric of the business encompassing information in
all forms.

The impact of electronically stored information on corporate legal and compliance management: An IBM point of view
Page 14Highlights• Recognizing that a growing volume of digital information has no physicalcounterpart (absence of system data, metadata, embedded files and so forthdifferentiates any attempted physical representation), and that litigation
discovery demands can routinely require the production of ESI, 8 morecompanies are beginning to manage ESI as records. One example is e-mailrecords being retained in searchable, electronic archives to meet requirementsof U.S. SEC Rule 17a-4 for retention and timely production of specificcommunications when requested. Meeting this requirement would not be
feasible in all but the smallest of organizations without the electronic
records archive.

• How pervasive is this phenomena? Today’s fully automated business processes
may result in ESI being the only complete record (for example, the IBM teamobserved in one insurance company that 80 percent of the claims were autoadjudicated [settled using software and automated transactions] with noFully automated end-to-end businesscorresponding physical record file of the transaction. Another example is thatprocesses may result in ESI being theit is unlikely that all e-mails containing essential business information are all

only record, with no physical counter-

printed and, even when they are printed, they lack valuable metadata, which

part. For this reason as well as trends

makes the physical form “incomplete” as a record).

in legal discovery, ESI should not be
overlooked by corporate records
managers.

• As systems and processes are changed, for example, to take advantage of
new technology, there might be unanticipated effects on records. At one
company that the IBM team studied, the system for producing customer replies— correspondence from customer service — composed responses on-the-fly(from various text components in the system) but did not produce a record that
could be filed with each customer’s account record and therefore be available,in the event of subsequent customer inquiries, to the account representative.
Customers might, therefore, complain that they did not receive notification by
the company of procedural changes having an impact on their business, andthere would be no record to prove they had been appropriately notified. This isa not uncommon example of how electronic systems might not create (much lessretain) a “record” unless they are specifically designed to do so.

The impact of electronically stored information on corporate legal and compliance management: An IBM point of view
Page 15Highlights• Digital information can be searched, analyzed, shared for collaboration orprocessing, and produced more readily than physical forms if appropriate
policies, tools, and protocols are in place. A concerted effort to create aneffective records management program for ESI might reduce volumes of physicalmaterial held in storage considerably and significantly decrease discovery
efforts and production of physical records.

• Documents created as ESI can be handled in consideration of record
requirements from the beginning of the lifecycle (for example, identify witha record series or case file at creation). This can be done effectively with a
combination of document management and records management enabling
technology, and be facilitated further with archiving strategies and tools,
especially for massive volumes of ESI in e-mail and messaging systems.
A hold management and e-discovery
strategy should consider:

Issue 4: Lack of hold management and e-discovery strategy and support• Both hold management and electronic discovery are processes that can benefit
Developing a standard appproach.

from a more standardized approach than is used in many companies, based on
our experience. Although the IBM team has observed that some companies have

Maintaining a document production

designated a team to disseminate document preservation orders, the actual

and investigation capability.

implementation of these, as well as discovery orders, might be undertakenwith sparsely defined, ad hoc processes and minimal preparation, rather thanEstablishing a consistent team with

with a structured approach. Lack of an established infrastructure, repeatableappropriate skills.

protocols, and a skilled, experienced electronic discovery team means thatlessons learned are not learned, ineffective approaches might be repeated andEstablishing a set of tools forunacceptably voluminous amounts of material might need to be culled after

providing results and establishinginitial collection, increasing response time and costs.

protocols.

The impact of electronically stored information on corporate legal and compliance management: An IBM point of view
Page 16• Maintaining a timely document production or event-investigation capability
means having the required people, business processes, technology and datareadily available as needed. Typical steps for such a process to consider inreadiness and planning exercises are:

- Preparation for the discovery or investigation effort- Project, event or matter folder creation- Keyword, advanced search and analytic tools- Appropriate reviews and analysis- Output media creation- Output media delivery
You should consider all these steps when developing a document or data
production plan. An understanding of each in the context of a specific businesscan in turn be helpful in promoting the negotiation of reasonable timelines andefforts when faced with demands.

• Effective use of electronic discovery and search tools is often influenced by theamount of experience with the process and the tools. Establish a consistent teamwith appropriate skills in electronic discovery and knowledge of your company’s
ESI sources, technology platforms and tools.

• Establish a set of tools that can provide predictable results based on establishedprotocols. Also conduct benchmarking exercises periodically against a varietyof ESI sources to establish metrics using your tools of choice. These metrics will
help to establish the time frames and costs of searching various electronic source
systems using various scenarios and parameters. For example, how long does ittake to search and report results on 20 named individuals in your e-mail system
regarding one matter over a period of three years?

- Understand the metrics and time requirements for simple search, de-duping andcreation of “collection” stage files, separate from the time and effort required
for legal or other reviews, advanced searching, and culling of nonrelevant or
privileged information. Conduct the benchmarking on current systems, retired
systems and archive systems.

The impact of electronically stored information on corporate legal and compliance management: An IBM point of view
Page 17

Highlights• For an e-mail production, it is important to have a catalog of all messaging data
sources. To maintain full legacy retrieval capabilities, this might, for example,
include:The electronic discovery strategy
should consider:• All sources of messaging data
• Hold management rules- Optical disk catalog- Tape backup catalog- Legacy tape backup hardware currency- Legacy tape backup software availability- Legacy e-mail software versions• Hold management rules (prelitigation identification of potentially material
information and ongoing implementation of document preservation orders)• Records management versus
retention management policies

requires special attention and tools for ESI. The “rules” that will determine
which ESI are to be held (beyond their scheduled retention period) require
careful crafting (by legal counsel, perhaps with assistance from IT and LOB
managers) and an analysis of holdings in the context of ESI and businesssystems. A lack of a clearly defined “registry” for records (such as can beprovided by a document management or records management system) to which
the rules can then be applied, constrains adoption of automated techniquesand can lead to an outcome that all ESI is “on hold forever.” This means,for example, that although one or another large litigation has been settled,
other litigations might still be ongoing and because of the inability to clearly
distinguish which records are under any specific hold order, all ESI continues
to be retained indefinitely. Lack of effective hold management can threaten toparalyze IT organizations struggling with massive volumes of ESI that has been
on hold indefinitely.

• Investing in a “retention management only” approach compared to a records
management approach that can manage the lifecycle of specific records
appropriately might not be the shortcut it appears to be when one needs toimplement preservation orders or event-based retention periods. Having
retention policy embedded in each siloed repository (Large companies may
have more than 15 repositories), or retention folders crafted by users on-the-fly,means that each of these will need to be addressed in the event of a hold order. In
this manner, retention management can create further complexity rather than
reduce complexity. Also, the communication of events — such as the expiration ofa contract or completion of an audit — becomes far more difficult to implement.
When records management is treated as an automated service (with a single
rules engine that enforces controls across multiple repositories), legal holds
and corporate retention policies can be centrally managed. This simplifies
administration and facilitates compliance because the affected ESI can belocked down regardless of the repository or application in which the ESI resides.
Investment in records management (compared to retention management) is atime-proven approach.

The impact of electronically stored information on corporate legal and compliance management: An IBM point of view
Page 18

E-mail management
Highlights

Management of e-mail entails determining which e-mail should be treatedas records and establishing classifications and retention rules based on
business context.

Perhaps the most-frequently asked question when an IT organization begins toestablish retention protocols for e-mail is “How should e-mail be handled?”
The best practice is for IT to consult with compliance, legal and audit advisors,and identify the key regulatory requirements applicable to the business. For
example, there are specific requirements for retention and retrieval ofcommunications (which would include instant messaging and othertechnologies in addition to e-mail) if your company is in the brokeragebusiness. Examples would include the U.S. Securities and Exchange
Commission (SEC) Rule 17a-4 and National Association of Securities Dealers
rules (NASD 3010/3110), and other SEC and NASD rules can apply dependingon the specific services offered by your business. Another example of industry
requirements is the U.S. Federal Energy Regulatory Commission (FERC) 18
CFR, Part 125, which describes a detailed list of record classifications andretention requirements applicable to electric utility licensees.
There are also laws such as SOX that apply to many enterprises by virtue of
their public company reporting requirements. Enforcement agencies often
have broad authority to examine company records, especially those whichevidence chain of custody and audit trails for developing financial informationthat is made public.
Other laws, such as the U.S. Patriot Act, may also be applicable to many typesof businesses. Regulations are promulgated by the federal agencies in theexecutive branch of the U.S. government that are responsible for enforcementof certain laws. There can be several agencies which have responsibilities fordifferent aspects of a statute. Creating the regulations and having them
reviewed, approved and released is generally a lengthy process, and there canbe many months between the time that a law goes into effect and the time thatthe regulations that specify compliance requirements are published andmade effective.
Retention policies are, as a best practice, based on the business value andbusiness context of the information, not on the “system” in which it ismaintained. Therefore, e-mail communications associated with employees
engaged in one role can be given a three-year minimum requirement forrecords retention, whereas in another role, e-mail communications can be
subject to different retention policies — such as a seven-year minimum if related
to company financial information.9

The impact of electronically stored information on corporate legal and compliance management: An IBM point of view
Page 19

Is records management practical for ESI?
Highlights

Implementing records management
for ESI requires a pragmatic approach.
Keep classifications, file plans, andretention categories as simple aspossible when first establishing
the program and refine as theimplementation and the cultural

As a starting point, the business needs ought to drive ESI retention policies.
To promote the establishment of reasonable as well as practical policies, it ispossible to establish some ground rules that can be broadly applied in theabsence of any specific regulatory requirement. For example, considering thatmany retention periods are event driven, a policy might be established that
retention periods that are triggered by completion of an audit (quality audit,
financial audit, regulatory audit and so forth), are all the same number of years.
This rule could be, for example, expressed as audit + 3 months and, in someenterprises, could cover a wide range of records.

acceptance matures.

Another useful strategy when dealing with ESI retention policies, andespecially with a system such as e-mail that covers a wide range of businessactivities, is to establish — as an initial step — some broad categories, which canbe refined in later stages of a records management implementation. These
categories could be as broad as financial, engineering, manufacturing,customer relations, human resources and so forth.10 The retention periods
initially assigned to the whole category can be longer than required for some
information classes within the category, but these provide an initial level ofmanagement that is not complex to implement, and through the prudent use ofaudit trails, can later be refined without undue risk. Those categories presenting
the greater business implications or risk can be made the priority for therefinement step, as the goal is generally to retain the minimum amountfor compliance.
Audit considerations

Supporting audits — whether regulatory audits, financial audits, internal audits
or other — requires some additional ESI management capabilities beyond thosemost often needed for general legal discovery. These capabilities pertain tosafeguarding the integrity and trustworthiness of records and being able todemonstrate those controls.
Auditors require that records produced for their review be trustworthy andauthentic, and maintained, therefore, with safeguards that prevent tamperingor modification of completed records. Auditors must be comfortable that therecords they examine are objective evidence of business processes and of thecontrols that have been exercised in those processes.

The impact of electronically stored information on corporate legal and compliance management: An IBM point of view
Page 20

Highlights

Consider an “evidence repository” for
ESI that provides a record of the proper
application of business controls

Auditors might be reviewing records for a special investigation or toperiodically verify that the organization is in compliance with pertinent
regulations. Certain regulatory bodies conduct audits on a regular schedule,
such as once every two years. To be prepared for these audits, protocols shouldbe established that leverage previous audit results and documentation, types ofrecords that are customarily requested, and ESI that must be made available. It
is a common practice for auditors to send the organization’s compliance officer(or other designated contact) a list of documentation and ESI (sometimes
specific data sets) that he or she needs to review or test and therefore expect to
be available at the commencement of the audit. If this information is notavailable, or not acceptable because of a lack of controls, the organization canbe cited with a deficiency, which could result in a reported noncompliance andpossibly penalties. One example that was widely reported in 2005 is the SEC/
NASD and New York Stock Exchange levy of $8.5 million in fines on fivebrokerage firms for failure to preserve e-mail communications.
To evidence authenticity and trustworthiness, ESI that are records being
retained for compliance should be: 1) locked down in a manner that preventsmodification or premature destruction, 2) created and managed in a mannerthat provides an audit trail and demonstrates the chain of custody, and 3)
controlled throughout their lifecycle and captured as closely as possible to thetime that the ESI became a record (upon completion or upon final approval, forexample, in accordance with predefined protocols).
Summary of best practices for electronic records management

Best practices for electronic records management, which can help support bothcompliance and legal discovery processes, include: 1) repeatable processes
guided by policies, 2) standards for various types of ESI classifications andmetadata, 3) enabling technology to support consistent practices and policy
implementation, 4) a change management strategy based on leadership,
education and awareness, and 5) enforcement and measurement of compliancethrough management audits and corrective action programs.

The impact of electronically stored information on corporate legal and compliance management: An IBM point of view
Page 21

Highlights

Control through a corporate records management policy.

• Consider the information fabric of your organization and create policy-based
rules for managing ESI that will not only facilitate discovery and document

Design the retention program within

production activities, but will yield business benefits as well. Defining andthe context of your business.

incorporating records life-cycle-based controls and retrieval protocols will also
facilitate meeting trustworthiness and authenticity requirements. Across the

Evaluate sources of ESI.

enterprise, e-mail, instant messaging, call center records, files on shared drives
and personal computers, and so forth, can all contain records related to the same

Implement policies and records-

business event or activity. These cannot be consistently managed and controlled

destruction practices.

without a policy.11 Policies ideally should be based on business context andvalue, not the format of the ESI. Policies might cover not only retention

Update IT governance practices.

requirements, but management practices and controls also, with minimal
standards for metadata, for example, across the enterprise.

Consider the impact of encryption
policies.

Make retention decisions in the context of what the data represents, where it resides,
longevity of preservation, and vitality of systems

Consider the impact of destruction
methods.

• Evaluate systems (sources of ESI) and determine how older information mightreasonably be accessed — and if it cannot reasonably be accessed, examine
critically why it is being retained. Technology organizations can evaluate needs
for archiving and retention systems that can provide reasonable access in the
future to ESI that has aged beyond the time it is required to be maintained in thecurrent information stores. Establish total retention periods and those for eachlife-cycle stage, such as “archived, but online.” Basic retention classes could bebased on business roles of the originator, the organization of the originator, or
the business activity (for example, customer service communications).

• Implement policies and records-destruction practices in accordance with
documented protocols that become part of the normal course of business.

• Update IT governance practices to include identification of retention
requirements (based on legal, regulatory or other factors) in the design
requirements for new systems. If the enterprise is involved in a merger or
acquisition of another company, identify requirements before data conversion
activities or legacy systems disposition decisions begin. Create a linkage to theoverall records management program for ESI.

• Consider the impact of encryption policies on search and retrieval capabilities.
With the increasing adoption of encryption for e-mail and attachments,
there are concerns that e-mail will not be searchable because of “loss” of theappropriate encryption keys, introducing further complexity to maintain
accessibility of aging ESI. ESI that is subject to production but cannot be
decrypted could result in raising suspicions of spoliation.

The impact of electronically stored information on corporate legal and compliance management: An IBM point of view
Page 22

Highlights• Consider the impact of destruction methods and available technology. If ESI
that is aged past its required retention period is not destroyed in a manner that
addresses the complete record (metadata as well as the document or content, forexample) and expunges in a manner that reasonably precludes reconstruction,
you might be creating risk. In any event, ESI should be destroyed using standard
protocols and in compliance with established policies and practices directed at“electronic shredding. ”

The capability to trigger retention
periods based on a business event,for records residing in a variety ofrepositories, is required for enterprise
records management.

Maintain documentation of corporate records retention policy changes• Maintain an audit trail of policy changes, approvals of changes, and effective
dates of policies and policy revisions.

• Multiple regulatory requirements can pertain to any particular class of ESI.
Therefore, when there are changes in any particular regulation affecting
records, the impact of that change on the retention policy must be evaluated inconsideration of other requirements that might apply.
Implement records management policies for ESI across the enterprise• Many organizations are making e-mail communication an early priority for ESI
that is brought into a records management program. It has long been a rule ofthumb among records management professionals that with the implementationof a records management program, volumes of information being retained inprimary storage might be reduced as much as two-thirds. That is, approximately
one-third of the material can potentially be destroyed in accordance withestablished corporate policies, and another one-third can be moved to less-costly
records storage (with appropriate controls to provide security, protection fromloss and so forth). Considering the volume of ESI in messaging systems, thismight make records management a more attractive proposition and a higher
priority for those systems.

• Establish standard practices (automated where feasible) for regular destructionof ESI (for example, on a monthly or quarterly basis) that are not unduly
burdensome on employees.12 Establish communications and oversight practices
that reinforce awareness and promote compliance. Destroy ESI as soon as ispossible, on a regular, consistent basis and use methods that promote security
and privacy for the information being destroyed (for example, don’t toss a CD in
the trash basket).

The impact of electronically stored information on corporate legal and compliance management: An IBM point of view
Page 23

Highlights• Because many retention periods are triggered by an event, an event notification
to the records management system to trigger the start of a defined retention
time period is critical. Uncertainty over whether or not an event has occurred(such as termination of a contract, for example) might cause excessive retention
beyond legitimate requirements. To remedy this, the best practice might beto provide either a system event-notification capability that communicatesfrom the business system to the records management system, or provide
manual procedures to address the areas of greatest risk or expense. With anunderstanding of the key retention requirements (such as ability to recreatecustomer transactions and communications for a lengthy period to satisfy
some regulations), records might also be tagged at the time they are created or
declared in a manner that facilitates this process, such as standard customer
identification schemes. Any ESI that is on hold would have the retention period
trigger set “on” when the event has occurred, but would not be destroyed until
two conditions are met: the “hold” was lifted and the retention period has expired.

Trends in legal discovery indicate that

Establish traceability and provenance where required

the legal team can benefit by being

Establish basic metadata13 that will be maintained as part of the record for eachclass of ESI and implement metadata standards.14

armed with knowledge of ESI sources
and retention processes.

• In the case of e-mail communication, maintaining who sent it, who viewed it
and who replied, can establish the provenance and context of thebusiness activities.

• Consider methods to externalize the content using a text format like XML, tied
to the metadata of the record where there can be cost or business benefits.

• Establish definitions and policies to clarify and distinguish final documents
versus drafts as part of the life-cycle controls.

• Metadata associated with specific classes of ESI can be leveraged to also
accomplish risk management goals. For example, metadata could be used to
identify and then secure transactions by embedding the appropriate rules inrouters (based on roles and responsibilities) or by triggering encryption.

• Identify audit-trail requirements when developing metadata standards. If there
are requirements for traceability and chain of custody, for example, capturing(as metadata) who did what and when they did it (who created, who updated,and so forth) should be part of the metadata standard.

The impact of electronically stored information on corporate legal and compliance management: An IBM point of view
Page 24

Highlights

Negotiate what makes sense• The legal team should be armed with an understanding of what ESI isaccessible and what is not before entering electronic discovery negotiations.

• Consider establishing a prototype (model of the system) for initial
implementation of policies and standards and development of key protocols
and training. Use the prototype to drive out requirements in meetings andworkshops and achieve agreement among technologies, legal, compliance andbusiness stakeholders.
Establish a document management system for lifecycle management• Document management technology enables controls to be implemented prior to
ESI becoming a declared record. For example, automatic destruction of drafts
can be triggered after a document is finalized and declared a record, reducing
the volume of ESI and storage costs.

• Shared drives — often used as a “dumping ground” — can be eliminatedover time.
Begin evaluating your readiness for

Be prepared for electronic discovery and production needs

legal discovery and the new rules• New U.S. Federal Rules of Civil Procedure may become effective by the endof civil procedure by reviewing yourof 2006, and are designed to provide some added ESI-related consistency intechnology and IT infrastructure

federal discovery procedures across the United States. Refer to the Appendix

capabilities as well as management

for highlights of the new rules and considerations to help prepare for them.

policies.

• Technology is an important element for enabling retention policies andsupporting compliance and legal discovery for ESI. In many cases, this can beaccomplished in ways that are transparent to the end user and nondisruptive
to business activities. Some of the potentially most useful technologies toconsider are:- E-mail archiving (online, single instance e-mail archive)- Metadata management- Records management- Contextual analysis and classification- Analytic tools (visualization and relationships)- Document management- E-mail search- Content integration

The impact of electronically stored information on corporate legal and compliance management: An IBM point of view
Page 25

Conclusion

Managing ESI within the context of a company-wide records management
program facilitates a number of corporate goals — risk management, corporate
governance, compliance with regulations and less-disruptive legal discovery
efforts. The greatest benefits are achieved by these programs through strong
leadership that promotes a culture of compliance and with the aid of supporting
processes and technologies that manage the growth and structure of ESI in thenormal course of business. In many companies, this is a significant
undertaking and requires the ongoing cooperation of legal, compliance,technologies and LOB stakeholders to evaluate ESI sources, participate inpolicy decisions and provide for effective implementation practices.
For more information

To find out more about how IBM can help you, contact your IBM representative,
Business Partner or visit www-306.ibm.com/software/data/commonstore/

The impact of electronically stored information on corporate legal and compliance management: An IBM point of view
Page 26

Appendix

Preparing for the upcoming electronic discovery amendments to the
U.S. Federal Rules of Civil Procedure
The Judicial Conference has recently submitted a series ofamendments to the Federal Rules of Civil Procedure to the Supreme
Court and the U.S. Congress for final approval.15 According to the
Judicial Conference, these amendments are specifically targeted toaddress problems associated with the discovery of electronic
information that were first discussed at an advisory conference in
1996. The advisory committee first began work on this in 2000 andhas involved a large number and variety of experts in the fields of law
and computer science and members of the public to arrive at theseamendments, which are anticipated to take effect in December 2006.
For businesses in the United States, these amendments will be ofinterest to compliance and regulatory affairs executives as well as
general counsel as the rules of civil procedures also apply toregulatory investigations.
One of the committee’s key findings was that the discovery of ESI
differs markedly from that in paper form, which naturally has been thefocus of conventional discovery procedures. A few of the differences it
cited include:• Exponentially greater volumes exist than with hardcopy documents• Unlike paper, the information is dynamic, being affected by theturning on and off of the computer itself, or by the computer deleting or
overwriting information without the operator’s intervention or direct
knowledge• Electronically stored information, unlike words on paper, might beincomprehensible when separated from the system that created it (lossof context, structure and other problems)

It also found that the discovery of electronic information is becoming
more costly, time-consuming and burdensome than for hardcopy
information. The committee determined that unless timely action istaken to address these problems and make the federal discovery rules
better able to accommodate the distinct features of electronic
discovery, a patchwork of local rules might arise that could lead toinequalities in the American judicial system.

The impact of electronically stored information on corporate legal and compliance management: An IBM point of view
Page 27

Likewise, timely action by legal counsel and compliance officers to
prepare their business for the amended discovery rules could make adifference in turning these rules to their advantage or disadvantage infuture litigation. To facilitate assessing the impact of these rulechanges on present protocols and practices for maintaining ESI in yourbusiness and identifying possible actions you may wish to proactively
initiate, Table 1 provides a quick summary of the rule changes withsome limited, suggested actions that you might want to consider. The
list is not intended to provide legal advice, of course, or to be complete
or exhaustive, but can be a starting point for consideration anddiscussion with your counsel. Without a doubt, a greater
understanding of the technology environment and ESI controls on thepart of legal counsel, and their partnering with IT leaders and decision
makers in regards to approved practices for ESI preservation anddestruction, will be a requirement for prudent businesses in the future.
A secondary assessment of the impact of these rule changes on
protocols for each of the stages of the discovery process would also beappropriate: that is, how they can affect implementing preservation
orders (record holds) for ESI, collection of ESI, culling of the ESI
collected, electronic review of the culled ESI and production of ESI.
This can then provide a framework for identifying new skills, systems,
planning, training and supervisory functions necessary to provide forcompliance with legal and ethical obligations regarding the discovery
of ESI.

The impact of electronically stored information on corporate legal and compliance management: An IBM point of view
Page 28

Rulereference

Rule change

Strategic

Tactical actions

26(b)(2)Procedure to negotiate
ESI sources forelectronic discovery

Counsel partners with
1. Take an inventory of
IT leaders to understand
ESI sources:
and influence ESI• Systems
storage and destruction• Repositories
practices• Network drives• Notebooks• Mobile devices• Locations• Business content• Business owners• Retention anddestruction 		practices• Formats
2. Develop protocol
and metrics for ESI
collection
3. Develop metrics
and estimates for“burden” of discovery
from each source

Goals

1. Proactively
understand sourcesof ESI and relevanceto discovery
2. Be prepared to
identify potential
sources and the
difficulties andcosts associatedwith producing suchmaterial, productionof which might
be deemed an
unreasonable burden
3. Successfully
negotiate appropriate
limits of discovery*

Rulereference

Rule change

Strategic

Tactical actions

Goals

26(b)(5)(B)

Withdraw privilegedor attorney work
product information
inadvertently produced
during electronic
discovery without
inferring waiver ofprotection

Policy for identifying
ESI as privilegedor attorney work
products

1. Categorize and rank
ESI sources andcontent as privilegedor attorney work
products

1. Mitigate riskof inadvertent
production of ESI
that is privilegedor attorney work
products

2. Develop method
and supporting
technical approach
to identify privileged
and attorney work
products (forexample, content
attributes)
3. Develop protocol
for requesting
return, sequesteror destruction ofprotected material byreceiver

Table 1. Summary of rule changes

2. Mitigate risk of waiverof protection

The impact of electronically stored information on corporate legal and compliance management: An IBM point of view
Page 29

Rulereference

Rule change

Strategic34(b)1. Negotiating the forms
in which ESI is to be
produced

1. Counsel and IT
1. Identify software and 1. Minimize cost andleaders partner toversions needed totime to produce
mutually understandaccess ESI in each
ESI by solid
the structure and
ESI source
understanding of
capabilities of their IT
capabilities andresources
2. Identify legacy
resources early in theand archived ESI
discovery process.
2. Establish policy forand software andstandard, “useable”**
protocols needed to
2. Improve predictability
formats that makeaccessof discovery costs
sense for boththrough standard
the business and3. Identify protocols for
protocols andelectronic discovery
production of ESI in
standard formats.
needs
standard formats (perpolicy)2. Allowing for
production of ESI
in the form in which
the party ordinarily
maintains it or in areasonably useable
form (and requires it
be produced in only
one form)

Tactical actions

Goals

4. Develop method
and protocol for
determining metrics,
and time andresource estimatesfor production instandard formats
Rulereference

Rule change

Strategic

Tactical actions

Goals

37(f)

Limitations on sanctions
for certain losses of
ESI, typically causedby routine system
operations***

1. Counsel partners
with IT leadershipauthorizing retention
and destruction
policies

1. Identify datadestruction protocols
for categories of dataand consistent witheach ESI source

1. Substantiate “goodfaith” and due
diligence to preserve
relevant information

2. Counsel and IT
2. Identify which ESI
together develop andrecords or dataapprove policies andclasses are “at risk” ofmethods for datapremature destruction
destruction
as a result of “routine,
good-faith operationof an electronic
information system.”

2. Avoid potential
sanctions throughappearance of
inattention or
indifference topreservation
responsibilities

3. Have measures toensure preservation
3. Determineof ESI that is
appropriate methods
not “reasonably
and protocols toaccessible” undersuspend routine
Rule 26(b)(2)*
destruction to prevent
loss of information
known to havepossible relevance tolitigation

Table 1. Summary of rule changes - continued

The impact of electronically stored information on corporate legal and compliance management: An IBM point of view
Page 30* According to the firm of Morrison & Foerster,16 a party that makes information“inaccessible” because it is likely to be discoverable in litigation is subject tosanctions now and would still be subject to sanctions under the
new amendments.
** The definition of useable more frequently includes word-search capability (thatis, would exclude TIFF or other nonsearchable formats).
*** Some examples of routine operations that might be examined in a good-faitheffort to protect against spoliation sanctions include:•

Suspension of overwriting protocols for backup tapes that are being retained
for recovery of data in the event of a broader disaster or a system failure,or migrating data on potentially relevant backup tapes to a “reasonably
accessible” electronic archive.

•

Suspension of automatic e-mail deletion and destruction processes.

•

Implementation of measures to protect hard drives for departing or transferring
employees and for recycled computers.

•

Communication of methods for preservation of potentially relevant ESI to all“covered persons,” including that ESI normally stored on their own computersand disposed of at will.

•

Protection of servers and file shares from decommissioning or migration thatwould make ESI “inaccessible.”•

Retention of obsolete (legacy) software that might be needed to make ESI“accessible” that is stored in obsolete applications.

•

Preservation of “snap shots” and time stamps of data in relevant databases.

•

Preservation of documentation for legacy or obsolete systems that is necessary
to interpret the data, produce reports and otherwise make the data on thosesystems comprehensible.

The impact of electronically stored information on corporate legal and compliance management: An IBM point of view
Page 31

End notes
1

Throughout this paper, the term ESI is used to refer to allelectronically stored information, whether as structured data or“unstructured” content, including metadata. This is in keepingwith the terminology used by the U.S. Judicial Committee in the
proposed amendments to the Rules of Civil Procedure, April 2006

9

AMR Research reported in 2006 that 18 percent of companies theysurveyed regarded the establishment of a legally defendable information environment the most-influential issue driving
technology investments to address compliance. In addition, 84
percent of companies surveyed were addressing complianceenterprise-wide within North America. Source: John Hagerty andFenella Sirkisoon, Spending in An Age of Compliance, 2006. AMR
Research, Inc., 2006. p. 15.

10

2

In 2005, Network Computing reported that only 17 percent ofcompanies used a policy-based archiving system to preservee-mail. Source: Network Computing, May 12, 2005. www.networkcomputing.com/
3

According to Forrester Research, the typical enterprise has at least
three content repositories, and 40 percent have six or more.
4

Content integration technology is being used by some companies
as they move to a common technical platform. This technology
provides a single “content bus” or application programming
interface (API) that allows the connecting of multiple repository
products, network file systems and existing systems so they can besearched or managed as if they were one. This can provide a nearterm alternative for companies wanting to gradually migrate their ESI
from multiple, departmental platforms to a corporate, standard
technology platform, according to Intelligent Enterprise. Bruce
Silver, “Content: The Other Half of the Integration Problem,”Intelligent Enterprise, Vol. 8, No. 10 (2005), pp. 33-37.
5

6
See “Audit considerations” for further information regarding
trustworthiness and integrity.

Gartner cites destructibility as a principal difference between paperand electronic records, stating “Electronic evidence is much harderto destroy than paper evidence, mostly because it is easier to disseminate and has metadata stored with it. There are multiple copies
of electronic communications. Although one can easily find 10 paper
copies of a document in a company, there may be hundreds ofelectronic copies. E-mail often is stored outside the originatingcompany on Internet service providers’ servers, as well as recipients’servers and hard drives.” Debra Logan, John Bace, Mark R. Gilbert,
Understanding E-Discovery Technology, Research ID G00133224,
Gartner, Inc. November 29, 2005, p. 2.
7

According to the U.S. Judicial Conference Committee on Rulesof Practice and Procedure, there are inherent differences between
physical documents and ESI. “The proposed amendment to Rule26(a) clarifies a party’s duty to include in its initial disclosureselectronically stored information by substituting“electronically stored information” for “data compilations”(p. Rules – 26). Also, “Under proposed amendment to Rule 34
electronically stored information is explicitly recognized as acategory subject to discovery that is distinct from “documents”
and “things”.(p. Rules-28).
8

Keeping track of the basis of retention decisions is also a bestpractice. Specific retention policies might need to be reevaluated in
the future because of changes in laws or business activities, and it isimportant to understand if retention decisions were driven by
specific regulations, business activities, roles or other criteria.
Corporate records management policies can designate a“disposable information” category constituting, for example, any
information that is not essential or reference information required forthe business, and mandate that this information should be disposedof immediately. If this class of information is identified in, forexample, an archive for ESI, the policy can be applied to give it aminimal default retention period in the system, or even to not migrate
it into the archive. This precludes the accumulation of extraneous
messages, for example, in the messaging archive. This would
facilitate consistency with the company’s policies for physicalrecords management practices in cases where this “disposable
information” is excluded from physical corporate records retention
schedules and prohibited from physical records storage.
The technology strategy and platform is critical to enable theconsistent application of policies applicable to any particular
category of business information for which the corresponding ESI
is maintained in disparate systems. Experience has shown that
employing a technical approach that centralizes records
management policy administration but can provide a“federated” approach to records controls might be necessary
in many organizations.
11

That is, destruction based on records management policies andany applicable court orders for preservation of ESI.
12

Metadata should be consistent with standards for master data anddata standards for official system of record where applicable as bestpractice.
13

Changing or enhancing the metadata of legacy ESI (any ESI
retained as a record prior to implementing the standards) should beconsidered with care if it is being retained for compliance because
this could be construed as “altering” an existing record.
14.1. Committee on Rules of Practice and Procedure, Report of the
Judicial Conference: Committee on Rules of Practice and Procedure
Federal Rules of Civil Procedure, Agenda E-18 Rules, Appendix
C-1 (US Courts, Federal Judiciary), (www.uscourts.gov/rules/),
September 2005, pp.C18 – C109.
15

Steven M. Kaufmann, J. Alexander Lawrence, John L. Kolakowski,“Upcoming E-Discovery Amendments to the Federal Rules of Civil
Procedure,” Legal Updates & News, Morrison & Foerster(www.mofo.com), March 2006.
16

© Copyright IBM Corporation 2006
IBM Corporation
IBM Raleigh (RTP)
Building 500
4205 S Miami Blvd
RTP, North Carolina 27709-2195
U.S.A.
(919) 543-0091
Produced in the United States of America
10-06
All Rights Reserved
IBM and the IBM logo are trademarks of International Business
Machines Corporation in the United States, other countries orboth.
Other company, product and service names may be trademarks
or service marks of others.
Disclaimer: Companies are responsible for ensuring their own
compliance with relevant laws and regulations. It is the client’s sole
responsibility to obtain advice of competent legal counsel as to theidentification and interpretation of any relevant laws, including but
not limited to, the Sarbanes-Oxley Act, that may affect the client’s
business and any actions the client may need to take to comply withsuch laws.
IBM does not provide legal, accounting or audit advice or represent
or warrant that its services or products will ensure that client is incompliance with any law.
The information contained in this presentation is provided “as is”
without warranty of any kind, express or implied. IBM shall not be
responsibly for any damages arising out of the use of, or otherwise
related to, this document. Nothing contained in this document isintended to, nor shall have the affect of, creating any warranties orrepresentation from IBM (or its suppliers or licensors), or altering theterms and conditions of applicable agreements governing the use of
IBM hardware, software or services.

G224-7582-00